🔴 Critical: PHP ships emergency patches for critical PHP2Shell flaws
-
The PHP security team has pushed out emergency patches addressing two critical remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell. Because these vulnerabilities allow remote code execution, successful exploitation could let an attacker run arbitrary code on affected systems, making them a high-priority fix for anyone running PHP in production.
Details on the exact affected versions and exploitation conditions are limited in the initial advisory, so administrators should treat this as urgent and apply the available patches as soon as possible rather than waiting for further clarification. Given the severity classification, delaying updates leaves systems exposed to potential compromise.
Recommended actions:
- Apply the emergency patches released by the PHP security team immediately.
- Review your exposure to PHP-based services and prioritize internet-facing deployments.
- Monitor vendor channels for updated guidance on affected versions.
Source: Unknown
Has your organization already patched, or are you still assessing which systems are running affected PHP versions?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login